Honeypot

A honeypot is a deliberately planted decoy — a server, account, file, or credential that looks like a valuable target but exists only to be attacked. Because no legitimate user or process has any reason to touch it, every interaction with a honeypot is a high-confidence signal that something is wrong. Where most detection tries to find the attacker's noise among millions of legitimate events, a honeypot inverts the problem: it creates a tripwire where the baseline is silence.

How it works

Classic honeypots are network decoys: a fake database server with an inviting name, an apparently unpatched machine on a segment attackers would scan, or an exposed service that logs every connection attempt. Interaction is recorded in detail — tools, commands, source infrastructure — which doubles as threat intelligence about who is probing you and how. Honeytokens extend the idea down to data: fake AWS keys in a repository, a bogus password in a vault, decoy records in a customer database, or a spreadsheet named "passwords.xlsx" that alerts when opened. Deception platforms scale this into whole environments of breadcrumbs designed to pull an intruder off the real path.

Honeypots are particularly effective against the post-compromise phase of modern intrusions. An attacker who has phished a foothold must explore: they enumerate shares, test credentials, and attempt lateral movement — exactly the behavior decoys are positioned to catch. Planted credentials also betray credential harvesting: if a honeytoken password is ever used to log in anywhere, something upstream has been stolen. The same tripwire logic applies to insider threats, where access to a decoy file nobody should open flags curiosity that policy forbids.

How to defend against it

For defenders the question is how to use honeypots well. Keep decoys realistic but isolated, so a compromised honeypot is not a bridge into production; route their alerts to a channel someone actually watches, with a rehearsed response — a tripwire that fires into an unread inbox is theater, and our guide to incident response for social engineering breaches covers what the first hour should look like. And keep the lesson in proportion: honeypots detect intrusions, they do not prevent them. The click, the credential, and the convincing phone call still come first, which is why detection layers sit alongside — not instead of — simulation and training for the people attackers reach before any decoy does.